CVE-2019-9764
HashiCorp Consul vulnerable to Origin Validation Error
Summary
HashiCorp Consul vulnerable to Origin Validation Error
Original description
The description as published by the source.
HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostname were set to false, even when it is actually set to true. This is fixed in 1.4.4.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Go
github.com/hashicorp/consul
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.4"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com